If you have ever killed a CRM procurement over a shaky SIG response, a vague AI data-handling policy, or an SSO behind an enterprise paywall, this page is for you. Strkr publishes the posture upfront so the review cycle runs in days instead of quarters.
A security-conscious buyer is not trying to block the deal. The security-conscious buyer is trying to protect the organization from the thing that shows up in the breach post-mortem. The pain points below are what Strkr onboarding hears from CISOs, security engineers, IT directors, and procurement security reviewers on nearly every mid-market and enterprise deal. Strkr's product was built with these objections in mind, which is why the security review usually closes in nine to fourteen business days instead of nine to fourteen weeks.
Most CRM vendors gate SAML and OIDC SSO behind their enterprise tier, which starts at $150 or $190 per seat. The security team wants SSO on day one, the finance team wants mid-tier pricing, and the deal stalls. Strkr includes SAML and OIDC SSO on the Scale plan at $119 per seat, with Verified Domains and MFA (TOTP plus text-based verification) live on every tier.
The AI capability shipped by most CRM vendors runs on third-party model calls with ambiguous retention, ambiguous training opt-out, and ambiguous data-residency posture. Strkr AI publishes the exact posture: retrieval runs scoped to the tenant, prompts are not used for model training, logs retain for 90 days by default (tunable per tenant), and the AI add-on is a single $49 per month line item instead of a usage meter the finance team cannot predict.
If your business touches protected health information even indirectly (through a client, a vendor, or an aggregator relationship), you need a Business Associate Agreement. Most CRM vendors offer the BAA only on the enterprise tier at a tenfold price jump. Strkr makes the BAA available on request at any paid tier. The compliance posture is honest: HIPAA ready with BAA, SOC 2 Type II in progress targeting 2026-Q4, GDPR and CCPA compliant today.
A real audit log captures record-read, record-write, email send, attachment download, AI call, and permission change. Most CRMs log only record-write, which fails the ABA Rule 1.6 standard, the AICPA peer review standard, and the SOX IT control standard. Strkr's audit log captures all six event classes with 90-day default retention tunable to the regulatory ceiling.
A security review wants to know the cloud provider, the region, the backup strategy, the key management posture, and the sub-processor list. Strkr publishes all five on the trust page. Primary infrastructure runs on AWS in us-east-1 and us-east-2 with cross-region backups, Clerk for identity, SES for transactional email, and a published sub-processor list that updates on each addition.
Multi-tenant AI features ship with real risk if retrieval scope is not strictly tenant-bounded. A prompt injection in a lead note can trick the model into surfacing another tenant's data, which is the kind of incident that lands in the Krebs on Security feed. Strkr AI runs with hard tenant isolation at the retrieval layer, prompt injection detection on all inputs, and output filtering before the model result reaches the user interface.
A security-conscious buyer does not want a sales pitch about security. The buyer wants the technical specification. Below are the identity, access, and tenant isolation defaults that ship with every Strkr tenant on day one, with the plan tier printed where it applies.
Full SAML 2.0 and OIDC SSO ship on the Scale plan. The admin configures the identity provider (Okta, Azure AD, Google Workspace, OneLogin, Auth0, PingFederate) in the admin console. Just-in-time provisioning creates the user record on first sign-in with the role mapped from the IdP group.
MFA with TOTP (Google Authenticator, Authy, 1Password) and text-based verification is live on every paid tier at $29 per seat on Starter through $119 per seat on Scale. The admin can require MFA globally, require MFA on sensitive resources only, or allow user-level opt-in.
Verified Domains is live on every tier. The admin claims the organization email domain through a DNS TXT record, after which no sign-up on that domain can bypass the IdP. The feature closes the social-engineering vector where an attacker signs up a new user outside the SSO flow.
The default role matrix is Owner, Admin, Manager, Member, Rep, Observer, and Guest. Each role maps to a scoped permission set across 54 resource types. The admin can clone and tune any role, add custom roles, and restrict any resource at the field level.
Every row in the Strkr database carries a tenant identifier. Row-level security policies enforce the isolation at the Postgres layer, which means an application bug cannot bypass the isolation through a missed where-clause. The posture holds for the retrieval index on the AI layer as well.
The admin console carries a tenant-level IP allowlist that can be enabled per role. The security team can require that admin and owner access run only from the corporate network or the VPN exit node. The feature is useful for regulated industries that run SOX IT controls on administrative access.
The admin console carries session-policy controls: idle timeout from 15 minutes to 8 hours, concurrent session cap per user, and forced sign-out on all devices. The security team can tune the posture to match the organization-wide identity policy.
When SSO is not in use, the password policy enforces minimum length, complexity, rotation cadence, and a breach check against the HaveIBeenPwned corpus. The policy inherits sensibly from NIST 800-63B but tunes down to a stricter corporate baseline when the security team requires it.
The vague AI data-handling policy is the single most common reason a CRM procurement stalls at the security review. Strkr AI publishes the exact posture across retrieval, training, retention, residency, and model-call routing so the SIG response writes itself.
Every Strkr AI call runs with retrieval scope strictly bounded to the tenant and (where configured per role) the record. A rep running an AI call on an opportunity sees retrieval limited to opportunities they can see in the CRM UI. The isolation enforces at the retrieval query layer, not the prompt layer.
Strkr AI does not use customer prompts, responses, or embeddings to train or fine-tune models. The default is opt-out, which means the admin does not have to toggle anything to protect the data. Opting in is possible for teams that want their patterns to improve their own retrieval index.
AI call logs (prompt, retrieval context, response, audit metadata) retain for 90 days by default. The admin can tune the retention down to 7 days or up to the regulatory ceiling (seven years for FINRA, six years for HIPAA, et cetera). The retention policy applies per tenant.
Every Strkr AI call runs through an AI Defense scan that detects prompt injection, jailbreak attempts, and PII exfiltration patterns. Suspicious calls get flagged in the audit log and (at admin discretion) blocked before the model sees the input. The posture closes the single most common AI-feature compromise path.
AI responses pass through a PII filter before they land in the user interface. The filter redacts credit cards, Social Security numbers, API keys, and bearer tokens. The admin can extend the redaction list for industry-specific sensitive patterns.
Strkr AI uses a three-tier router (ADR-026). Simple transforms run on a WASM path at zero marginal cost. Mid tasks run on a small model at under one cent per call. Deep tasks run on the frontier tier. The $49 per month AI add-on includes 5,000 calls. Overage is $0.012 per call. The invoice math is predictable.
Strkr runs on AWS in us-east-1 and us-east-2 with cross-region backups to a third AWS region. EU residency is on the roadmap. Teams with a hard EU residency requirement should flag it on the sales call so the trust team can discuss timing.
A real audit log is not a toggle in the admin console. It is a specification of which events get captured, with what metadata, and for how long. Strkr's audit log captures six event classes with 90-day default retention and admin-tunable retention per class up to the regulatory ceiling.
Every record read on a sensitive object (account, contact, opportunity, document, note) writes an audit entry with the user, the record ID, the timestamp, and the IP. The admin can tune which object classes capture read events, which is useful for high-volume read patterns like the pipeline board.
Every record write captures the field-level before and after state, the user, the timestamp, and the IP. The entry survives a subsequent delete, which closes the "someone deleted the evidence" vector.
Every outbound email and every Strkr Messaging message captures recipient, subject, body hash, timestamp, user, and delivery status. The body hash allows forensic reconstruction without storing the body in the audit log, which keeps the audit log light.
Every attachment download, every signed-URL generation, and every portal file access writes an audit entry. The entry carries the file ID, the user, the timestamp, and the delivery channel. The capture is required for AICPA peer review, ABA Rule 1.6, and HIPAA.
Every Strkr AI call writes an audit entry with the prompt text, the retrieval context identifiers, the response hash, the model tier, and the token count. The entry closes the AI governance gap most CRMs leave open.
Every permission change on the tenant (role grant, scope change, access revocation, SSO configuration edit) writes an audit entry with the actor, the subject, the before and after state, and the timestamp. The entry closes the "someone granted themselves access last Tuesday" vector.
The comparison below is Strkr's security posture versus a representative mid-market CRM at the mid plan tier. The question each row answers is: does the capability ship on the plan the security-conscious buyer actually wants to buy?
| Feature | Strkr | Typical mid-market CRM at mid tier |
|---|---|---|
| SAML and OIDC SSO at mid tier | Yes on Scale at $119 per seat. | Enterprise tier only at $150 to $300 per seat. |
| MFA on every tier | TOTP and text-based verification included. | TOTP only on upper tiers. |
| Verified Domains | All tiers. | Enterprise or add-on. |
| HIPAA BAA on request | Available at any paid tier. | Enterprise tier plus six-figure contract. |
| SOC 2 Type II | In progress targeting 2026-Q4. | Varies, often not published. |
| AI prompt training opt-out default | Opt-out is the default. No admin toggle required. | Opt-in default. Admin has to toggle. |
| Audit log event classes | Six classes captured by default. | Record write only. |
| Prompt injection detection | AI Defense scan on every call. | Not published. |
| IP allowlist | Admin-set per role on any paid tier. | Enterprise tier only. |
| Sub-processor list | Published and versioned. | Request from sales. |
Below are five patterns Strkr's security team sees across the 2026 procurement cohort. Each pattern is a real customer motion where the security review closed in days instead of weeks because the posture was published upfront.
A CISO at a 240-person fintech ran the SIG Lite against three CRM vendors. The two legacy vendors came back with vague "available upon contract execution" responses on 18 of 42 questions. Strkr responded concretely on 42 of 42 with links to the trust page, the sub-processor list, and the SOC 2 interim letter. The CISO finished the SIG in four hours. Procurement closed in nine business days.
A security engineer at a healthcare SaaS vendor ran a red-team exercise against three CRM AI features. Two leaked adjacent tenant data on crafted prompt-injection inputs. Strkr's AI Defense scan caught 11 of 11 injection patterns and the retrieval-scope isolation held on all 11. The team moved Strkr from the maybe pile to the approved pile in the same meeting.
A 90-rep sales team at a regional insurer needed SSO as a hard requirement from the IT director. The incumbent CRM gated SSO behind a $190 per seat enterprise tier. Strkr included SSO on the Scale plan at $119 per seat. The IT director approved the move on the pricing differential alone. Cutover ran in 22 business days. SSO was live on day one.
A procurement security reviewer at a Fortune 500 subsidiary ran a 90-item questionnaire covering identity, data handling, incident response, business continuity, and sub-processors. The reviewer flagged nine vendors for in-depth review. Strkr's published trust page, DPA template, and sub-processor list closed 72 of 90 items without a sales call. The remaining 18 closed in two meetings. Deal signed on day 18.
A Phoenix bookkeeping shop served medical offices whose chart of accounts touched protected health information. The compliance officer wanted a BAA. The incumbent CRM offered the BAA only on the $500 per seat enterprise tier, which was a nonstarter. Strkr offered the BAA on the Pro plan at $59 per seat. The compliance officer closed the review in one week. The shop closed its first medical-group multi-location deal six weeks after cutover.
Book a 30 minute call with Strkr's trust team. We will walk through the SIG Lite, the DPA, the sub-processor list, and the AI data-handling policy with your actual compliance obligations.
SOC 2 Type II is in progress with an observation period running through 2026-Q4. The trust page carries the interim letter and the audit firm name. The compliance posture is honest: Strkr is HIPAA compliant with BAA available on request at any paid tier, GDPR and CCPA compliant today, and SOC 2 Type II in progress. We do not claim certifications we do not hold.
Both. Strkr supports SAML 2.0 and OIDC on the Scale plan at $119 per seat. The admin configures the identity provider (Okta, Azure AD, Google Workspace, OneLogin, Auth0, PingFederate) in the admin console. Just-in-time provisioning creates the user record on first sign-in with the role mapped from the IdP group. SCIM provisioning is on the near-term roadmap.
Three layers. First, the retrieval query layer enforces hard tenant isolation. A Strkr AI call cannot read a row that does not belong to the calling tenant, because the query carries the tenant identifier as a non-overridable predicate. Second, the AI Defense scan runs on every call and flags prompt injection patterns before the model sees the input. Third, the output filter redacts PII and sensitive patterns before the response lands in the user interface. The three layers close the common AI compromise path.
Yes. The IP allowlist is a per-role setting in the admin console. The security team can require that owner and admin access runs only from the corporate network or the VPN exit node, while allowing rep and member access from anywhere. The policy applies to the API as well as the user interface, which closes the "service account from an unauthorized network" vector.
The audit log is included on every paid tier at no additional cost. The default retention is 90 days across all six event classes (record read, record write, email send, attachment access, AI call, permission change). The admin can tune retention per class up to the regulatory ceiling (seven years for FINRA, six years for HIPAA, et cetera). Extended retention does not require a plan upgrade.
Yes. The sub-processor list is published on the trust page and updates on each addition with 30-day advance notice to the admin on record. The DPA is a standard GDPR-compliant Article 28 template available on request through the trust page. For teams with a specific DPA language requirement, Strkr's legal team reviews turn-in in under five business days.
No sales call, no migration consultant, no four-month implementation. Enter your card, get 14 days of the full Pro tier, cancel any time before day 14 with zero charge. Spin up a workspace, import your CSV, and have something useful before lunch.
